Cryptocurrencies: why you should know about rollups

The world of block­chain and cryptoassets have seen bet­ter days. Indeed, we only need to look at the resound­ing col­lapse of the FTX exchange or the recent Eth­ereum update – the largest in the young his­tory of the crypto­cur­rency – to under­stand this. Nev­er­the­less, even if this news gets a lot of atten­tion, oth­er devel­op­ments are under­way in the cryptoasset world… More dis­creet cer­tainly, but no less influ­en­tial in the long run. Among them are rol­lups: a new tech­nique that research­ers identi­fy as being decis­ive for the future of cryptocurrency.

To bet­ter under­stand the import­ance of these tech­niques, let’s remem­ber that the block­chain is an indes­truct­ible sys­tem of records that any­one can con­sult at will. Moreover, any­one can write on it, which makes the block­chain a con­stantly evolving sys­tem. How­ever, it would bene­fit from becom­ing faster, cheap­er, and more envir­on­ment­ally friendly, which is one of the prom­ises of future trans­form­a­tions in this sec­tor. Espe­cially since these improve­ments are becom­ing increas­ingly urgent as block­chain is becom­ing more wide­spread across all sec­tors: sports, com­merce, and culture.

How­ever, it is not as simple as it may seem due to many obstacles, mainly due to the fact that these prom­ising devel­op­ments must pre­serve the three pil­lars of the block­chain: secur­ity (the net­work must be able to val­id­ate the authen­ti­city of trans­ac­tions); decent­ral­isa­tion (it must be suf­fi­ciently autonom­ous so as not to be sub­ject to a cent­ral body); and scalab­il­ity (i.e. its capa­city to pro­cess a giv­en num­ber of trans­ac­tions). This scalab­il­ity is the key­stone of cur­rent research, par­tic­u­larly in cryp­to­graphy. For example, Bit­coin can only pro­cess sev­en trans­ac­tions per second, com­pared with 24,000 for the VISA sys­tem. It is there­fore under­stand­able that the simple val­id­a­tion of a banal pur­chase can become a dif­fi­culty in the event of massive trans­ac­tions on the network.

To meet these chal­lenges in part, two import­ant con­cepts have become estab­lished in the field of crypto­cur­ren­cies: rol­lup and zero know­ledge.

The rol­lup mech­an­ism uses a cryp­to­graph­ic tech­nique called a Merkle tree (or hash tree). The hash trans­forms any input – a text or an image, for example – into a string of bytes of fixed length and struc­ture. In a single short trans­ac­tion, this Merkle tree makes it pos­sible to com­mit and con­firm not one, but thou­sands of trans­ac­tions with it, some­thing that was not pos­sible before.

To bet­ter under­stand the import­ance of the rol­lup, we need anoth­er essen­tial notion: the block head­er. This block, the one present in the term Block­chain, refers to those links where suc­cess­ive trans­ac­tions between users are stored chro­no­lo­gic­ally since the cre­ation of the block­chain, each of the blocks and their sequence being pro­tec­ted against any modification.

Even with­in the best-known crypto­cur­rency, Bit­coin, there is a notion of a block head­er and block con­tent. This head­er con­tains only the root of the Merkle tree, while the block con­tains all trans­ac­tions. This mech­an­ism makes it pos­sible, for example, to design light­weight applic­a­tions to man­age cryptoassets on smart­phones. These applic­a­tion pro­grams only use the block head­ers when pay­ing with bit­coins, for example, because they only weigh a few mega­bytes each, and do not embed the entire block­chain, which would be tech­nic­ally impossible to manage. 

It is pos­sible to approve thou­sands of trans­ac­tions that can then be veri­fied as hav­ing been ini­ti­ated. And all at low cost.

These head­ers are gen­er­ated by cryp­to­graph­ic hash­ing and val­id­ated by what is called a Proof of Work. This is the main con­sensus mech­an­ism of block­chains. The rol­lup mech­an­ism offers the same secur­ity as Bit­coin’s Proof of Work but, in real­ity, the user is only deal­ing with head­ers and does not see the entirety of the trans­ac­tions con­tained in the Merkle trees. Here, with very little inform­a­tion, it is pos­sible to approve thou­sands of trans­ac­tions that can then be veri­fied as hav­ing been ini­ti­ated. And all this at low cost.

This notion of rol­lup can be found on oth­er block­chains that include an oper­at­or: the fam­ous smart con­tracts, and first and fore­most Eth­ereum. This crypto­cur­rency is exper­i­en­cing an ever-increas­ing demand from users. As a res­ult, trans­ac­tion speeds are fall­ing, while trans­ac­tion fees are rising inexorably. 

With­in Eth­ereum, smart con­tracts are pro­grams stored in the block­chain that are auto­mat­ic­ally activ­ated by each trans­ac­tion. They guar­an­tee the integ­rity, valid­ity, and invi­ol­ab­il­ity of trans­ac­tions, if and only if all the con­di­tions are met. The whole pro­cess is auto­mated. How­ever, these smart con­tracts, which are executed with each trans­ac­tion, also slow down the val­id­a­tion system.

In a single oper­a­tion, 1,000 or 10,000 trans­ac­tions can be car­ried out. Today, Eth­ereum only accepts 12 trans­ac­tions per second.

The idea of integ­rat­ing rol­lups into Eth­ereum is based on the same idea as Bit­coin: free­ing up band­width. The rol­lup oper­at­or, which is actu­ally out­side the block­chain, reg­u­larly updates the root of the Merkle tree in a single trans­ac­tion filed on the main blockchain. 

This cryp­to­graph­ic mech­an­ism makes it pos­sible, with very little inform­a­tion, to provide evid­ence later that trans­ac­tions have been car­ried out, to prove their exist­ence in the future. In a single oper­a­tion, 1,000 or 10,000 trans­ac­tions can be car­ried out. How­ever, Eth­ereum cur­rently accepts only 12 trans­ac­tions per second, which causes trans­ac­tion costs to soar and makes this block­chain less and less attractive.

The major chal­lenge raised by this mech­an­ism is secur­ity, as it is neces­sary to ensure that the rol­lup oper­at­or does not make a mess of things. This pro­cess allows him to place a hash on the block­chain that does not imme­di­ately val­id­ate a pending trans­ac­tion. The block­chain must be able to cer­ti­fy the hash. Two philo­sophies emerge from this. On the one hand, there are the so-called optim­ist­ic rol­lups and on the oth­er hand, the rol­lups that are some­what inap­pro­pri­ately called zero know­ledge (ZK) rollups.

Optim­ist­ic rol­lups are proofs of fraud issued by agents, usu­ally pro­grams, that observe the block­chain and users’ trans­ac­tions. If the hash placed by an oper­at­or is fraud­u­lent with respect to the applic­a­tion rules, the oper­at­or is pun­ished, and the observ­er is rewar­ded. All this hap­pens over a long time-win­dow of sev­er­al days. This off-chain pro­cess is called optim­ist­ic because all that is hoped for is that this warn­ing mech­an­ism does not get triggered. 

The oth­er fam­ily, ZK rol­lups, works dif­fer­ently. Every time the rol­lup oper­at­or places the root of the Merkle tree on the block­chain, it also depos­its proof, in the cryp­to­graph­ic sense, that everything is cor­rect. This pro­cess uses a major concept in cryp­to­graphy called SNARK, which proves that a cal­cu­la­tion has been car­ried out cor­rectly. Above all, this proof is very short even if the cal­cu­la­tion is very long. If the cal­cu­la­tion involves 100 mil­lion oper­a­tions, it weighs only a few hun­dred bytes at most. This is a bit of a miracle. 

These two tech­no­lo­gies, optim­ist­ic rol­lups and ZK rol­lups, are based on the same philo­sophy: to reduce the amount of inform­a­tion per trans­ac­tion and to push the proof of valid­ity as far as pos­sible towards cryp­to­graph­ic mechanisms.

Jean Zeid